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ABSTRACT 

This  paper  presents  an  application  of  a  fault  detection  and  diagnosis  scheme  for  the  sensor  faults 
of  a  helicopter  engine.  The  scheme  utilizes  a  model-based  approach  with  real  time  identification  and 
hypothesis  testing  which  can  provide  early  detection,  isolation,  and  diagnosis  of  failures.  It  is  an 
integral  part  of  a  proposed  intelligent  control  system  with  health  monitoring  capabilities.  The  intelligent 
control  system  will  allow  for  accommodation  of  faults,  reduce  maintenance  cost,  and  increase  system 
availability. 

The  scheme  compares  the  measured  outputs  of  the  engine  with  the  expected  outputs  of  an  engine 
whose  sensor  suite  is  functioning  normally.  If  the  differences  between  the  real  and  expected  outputs 
exceed  threshold  values,  a  fault  is  detected.  The  isolation  of  sensor  failures  is  accomplished  through 
a  fault  parameter  isolation  technique  where  parameters  which  model  the  faulty  process  are  calculated 
on-line  with  a  real-time  multivariable  parameter  estimation  algorithm.  The  fault  parameters  and  their 
patterns  can  then  be  analyzed  for  diagnostic  and  accommodation  purposes. 

The  scheme  is  applied  to  the  detection  and  diagnosis  of  sensor  faults  of  a  T700  turboshaft 
engine.  Sensor  failures  are  induced  in  a  T700  nonlinear  performance  simulation  and  data  obtained  are 
used  with  the  scheme  to  detect,  isolate,  and  estimate  the  magnitude  of  the  faults. 

INTRODUCTION 

On-line  fault  detection  and  diagnosis  is  an  area  with  great  potential  for  high  payoff,  especially 
in  the  battlefield  environment.  The  ability  to  detect  and  isolate  a  fault  as  it  happens  allows  a  decision 
to  be  made  immediately  about  the  viability  of  the  system  and  the  likelihood  of  completing  the  mission. 
In  a  situation  where  the  unavailability  of  a  system  may  have  much  direr  consequences  than  merely  the 
loss  of  some  information  or  capability,  every  possible  piece  of  data  helps  in  gaining  the  advantage. 

Sensor  malfunctions  are  particularly  pernicious  because  they  might  cause  a  mission  to  be 
terminated  when  all  systems  are  actually  functioning  properly.  Prime  examples  of  this  come  from  the 
Space  Shuttle  where  numerous  sensor  failures  over  the  years  have  caused  subsystem  shutdowns  and 
aborted  launches  at  great  expense  as  well  as  posing  potential  danger  to  the  astronauts. 
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It  is  well  known  that  the  variables  in  complex  systems  are  often  correlated  and  that  this 
information  can  be  used  to  detect  and  isolate  incorrect  sensor  readings.  This  technique  allows  sensor 
failures  to  be  isolated,  and  it  allows  lost  or  incorrect  values  to  be  recovered  using  the  remaining  valid 
measurements  (DeLaat  and  Merrill  1984,  Guo  and  Nurre  1991). 

A  proposed  intelligent  control  system  contains  the  sensor  fault  detection,  isolation,  and 
accommodation  scheme  coordinated  with  complementary  schemes  for  the  actuators  and  components 
(Figure  1).  If  the  differences  between  the  estimated  and  sensed  system  outputs  exceed  some  threshold 
values,  the  fault  detection  logic  will  initiate  a  parameter  estimation  algorithm  which  determines  the  type 
and  magnitude  of  the  failure.  This  is  achieved  through  the  use  of  fault  parameters,  variables  defined 
to  convert  the  model  from  that  of  the  fully  functioning  system  to  that  of  an  impaired  one  as  their  values 
move  off  nominal.  Once  the  fault  is  isolated,  the  control  system  will  accommodate  it  if  possible  (Litt 
1990). 


The  test  bed  for  this  research  is  the  T700  turboshaft  engine,  which  is  used  in  pairs  in  the  army’s 
Blackhawk  and  Apache  helicopters.  It  is  a  1600  horsepower-class  modular  two-spool  engine  consisting 
of  a  gas  generator  and  a  free  power  turbine  (Figure  2).  In  the  simplified  model  used  here  there  is  one 
input:  fuel  flow,  Wf.  There  are  four  measured  output  variables:  gas  generator  speed,  Ng,  interturbine 
gas  temperature,  T45,  interturbine  gas  pressure,  P45,  and  power  turbine  torque  output,  QPT.  Should 
any  of  the  sensors  fail,  the  engine  would  appear  to  be  malfunctioning  and,  if  the  faulty  measurement 
were  fed  back  through  the  control  system,  the  engine  would  operate  off  the  design  point. 

SENSOR  FAULT  DETECTION  AND  ISOLATION 

The  Sensor  Fault  Detection  and  Isolation  scheme  is  developed  using  a  fault  model.  A  simplified 
linear  perturbation  model  has  been  developed  which  switches  between  several  point  models  for  full 
envelope  coverage  (Duyar,  Gu,  and  Litt  1992).  The  simplified  model  at  an  operating  point  is  of  the 
standard  form 


x(k  + 1)  =  Ax(k)  +  Bu(k) 
y(k)  =  Cx(k) 

The  variables  in  these  point  models  are  all  normalized  with  their  zero  values  corresponding  to  the 
operating  point.  We  assume  that  the  (A,  B,  C)  realization  of  the  system  is  in  a-canonical  form  (Eldem 
and  Duyar  1993).  Lack  of  space  precludes  a  thorough  presentation  here,  but,  very  briefly, 


c  =  [0 ;  jr1] 

A  =  A0  +  KHC 


(2) 


where  A"  is  a  deadbeat  observer  gain  (Kwakemaak  and  Sivan  1972),  and  A0  is  nilpotent,  i.e.  Aj1-  0  for 
some  fjL>0.  There  are  several  other  requirements  which  are  listed  in  the  references. 
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The  model  is  created  by  substituting  the  equation  for  A  from  (2)  into  (1),  evolving  (1)  through 
time  from  0  to  k,  and  rearranging,  thus 


y(k)  =  CA‘x(0)  ♦  E  CA‘0-'[KH  s  B] 


i=l 


y(k-i) 
u(k-i ) 


(3) 


The  fact  that  A0  is  nilpotent  is  important  because  it  allows  (3)  to  be  simplified  to 


y(k)  =  E  C<-'[KH  l  B] 


i=l 


y(k-i) 
u(k  - 1) 


(4) 


when  k>ix.  Once  in  this  form,  the  unknown  parameters  can  be  identified  using  a  least  squares 
technique.  This  way  the  initial  model  is  developed. 

The  sensor  fault  model  is  built  on  top  of  (1)  in  the  form 


x(k  +  l)  =  Ax{k)  +  Bu(k)  1 

ys(k)  =  FsCx(k )  +  W 

where  ys(k)  is  the  set  of  normalized  sensor  readings  at  time  k.  In  the  case  where  all  sensors  are  fully 
functional,  Fs  is  the  identity  matrix  and  is  the  zero  vector,  thus  reducing  (5)  to  (1).  The  diagonal 
matrix  Fs  accounts  for  changes  in  sensor  gain  while  a  non-zero  fs0  represents  bias  errors.  Substituting 
and  rearranging  as  before 


yXk)  = 


fsca. 


*(0) 


-  *  Y,f,ca'0''[khf;'  i  b] 

i=l  i=l 


ys(k-i) 

u(k-i)\ 


f so  (6) 


Using  the  nilpotency  of  A0  to  simplify  (6)  we  get 


y,(k)  =/„  -  E  FsCA,0~iKHF~'fs0  *  E  F.CA 

i=l  i=l 


i-1 

0 


KHF~l  i  B 

yfi-  o' 

u(k-i) 

(7) 


when  k>iJL.  Once  a  failure  is  detected,  an  on-line  estimation  technique  calculates  values  for  the  fault 
parameters,  and  Fs.  As  long  as  Fs  is  nonsingular,  the  value  of  the  parameters  along  with  some 
simple  logic  provides  an  assessment  of  the  type  and  magnitude  of  the  error.  In  the  case  where  Fs 
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becomes  singular,  implying  that  the  gain  of  a  sensor  became  zero,  a  logical  check  can  be  used  to 
determine  which  sensor  has  failed. 

SIMULATION  SETUP 

A  full  nonlinear  simulation  of  the  T700  turboshaft  engine  subjected  to  a  load  (Ballin  1988)  is  used  in 
the  simulation  test  bed  to  represent  the  engine  in  question  (Kurtkaya  1992).  The  fault  detection  and 
hypothesis  testing  modules  run  in  parallel  with  the  nonlinear  simulation  as  shown  in  Figure  1.  The  time 
step  used  is  60  ms.  All  programs  are  written  in  FORTRAN  and  are  embedded  in  Model-C,  a  control 
analysis  and  simulation  package. 

Past  controller  outputs  together  with  the  sensor  readings  are  fed  through  the  fault  detection  model 
described  by  (7)  and  the  resulting  estimate  of  the  set  of  sensed  variables  is  compared  to  those  received 
from  the  simulation  at  the  current  time  step.  The  differences,  or  residuals,  are  checked  against 
threshold  values  which,  when  exceeded,  activate  the  fault  detection  scheme. 

Initially,  the  system  is  assumed  to  be  functioning  normally,  thus  the  value  for  Fs  is  identity  and  7^,  is 
the  zero  vector  implying  no  multiplicative  sensor  gain  error  and  no  sensor  bias,  respectively.  The  fault 
detection  scheme  contains  models  appropriate  for  each  type  of  failure,  i.e.  actuator,  component,  and 
sensor.  Just  as  the  sensor  fault  parameters  are  associated  with  the  C  matrix  as  shown  in  (5),  the 
actuator  fault  parameters  are  associated  with  the  B  matrix  of  (1)  and  the  component  fault  parameters 
are  associated  with  the  A  matrix  (Duyar  et  al.  1991).  Fault  models  similar  to  (7)  are  derived  for  the 
actuator  and  component  failures.  When  the  residual  exceeds  the  activation  threshold,  an  on-line 
parameter  estimation  scheme  is  initiated  which  calculates  the  fault  parameters,  e.g.  Fs  and  fs0  in  the 
sensor  case. 

It  is  important  to  run  the  parameter  estimation  scheme  using  data  from  the  impaired  system  so  that  the 
results  are  not  skewed  by  pre-failure  information.  Therefore,  the  parameter  estimation  module  begins 
collecting  data  only  after  the  activation  threshold  is  exceeded.  A  recursive  least  squares  technique  with 
a  forgetting  factor  of  0.98  is  used  to  compute  the  value  of  the  fault  parameters.  The  models  of  the 
actuator,  component,  and  sensor  failures  are  developed  in  parallel  and  the  three  sets  of  fault  parameters 
are  computed  simultaneously. 

At  each  time  step  the  resulting  fault  parameters  are  passed  to  the  hypothesis  testing  module,  actually 
a  battery  of  simple  logical  checks,  which  determines  what  fault  occurred  using  the  identified  parameters. 
The  logic  assumes  that  only  one  failure  occurs  at  a  time.  The  result  is  checked  by  confirming  that  the 
selected  model  using  the  identified  fault  parameters  produces  a  smaller  sum  of  the  squared  errors 
(residuals)  over  a  fixed  time  than  do  the  other  estimated  models  using  their  fault  parameters.  In  this 
case  a  moving  window  of  five  data  points  was  used  for  summing  the  squares  of  the  residuals  before 
comparing  the  models,  resulting  in  a  delay  of  at  least  0.3  seconds  (5  samples  X  0.060  seconds/sample) 
before  the  error  is  isolated  and  its  magnitude  estimated.  This  data  length  is  selected  to  produce  reliable 
results  in  relatively  few  samples. 
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RESULTS 

Testing  was  performed  at  the  96%  power  level.  Results  for  two  types  of  faults  are  presented:  gas 
generator  speed  sensor  bias,  and  multiplicative  gain  error  of  the  gas  generator  speed  sensor. 

For  the  first  case,  a  sensor  bias  of  1.8%  of  nominal  was  introduced  to  the  nonlinear  simulation’s  gas 
generator  speed  sensor’s  output  at  the  start  of  the  run.  As  soon  as  the  bias  was  added,  the 
misinformation,  which  was  fed  back  for  control  purposes,  disrupted  all  of  the  other  output  variables  and 
caused  the  engine  to  operate  off  of  the  design  point.  The  fault  parameters  were  first  computed  after  the 
impaired  system  was  sampled  twice,  i.e.  0.12  seconds  after  the  threshold  was  exceeded.  Figure  3 
shows  how  the  fault  parameters  corresponding  to  the  multiplicative  sensor  gain  converged  immediately 
to  their  correct  values  of  1.0  as  determined  through  recursive  least  squares,  indicating  no  sensor  gain 
failure.  Figure  4,  on  the  other  hand,  shows  that  the  bias  on  the  Ng  sensor  converged  to  approximately 
0.018  while  the  other  bias  values  stayed  within  the  normal  expected  variation  around  zero.  Figure  5 
shows  the  results  of  the  hypothesis  testing  using  the  fault  parameters  determined  for  each  type  of  failure. 
The  sums  of  the  squared  errors  over  a  five  sample  moving  window  for  each  type  of  failure  were 
computed  beginning  with  the  sample  after  the  fault  parameters  had  been  first  estimated,  i.e.  0.18 
seconds  after  the  threshold  was  exceeded.  It  can  be  seen  that  the  sensor  fault  parameters  provided  a 
much  better  match  to  the  simulated  failure  than  either  the  actuator  or  component  faults  parameters  did. 

For  the  second  case,  the  original  unity  gain  of  the  Ng  sensor  was  scaled  by  a  multiplicative  gain  of  0. 1 
at  the  start  of  the  run.  Figure  6  shows  the  multiplicative  gain  fault  parameters  as  determined  by  the 
recursive  least  squares  technique  from  past  data.  It  took  significantly  longer  to  converge  than  the 
previous  example  did  but  eventually  the  parameter  corresponding  to  the  Ng  sensor’s  gain  converged  to 
about  0.1  while  the  other  three  hovered  near  1.0.  Figure  7  displays  the  estimated  values  of  the  bias 
parameters,  which,  after  some  initial  hunting,  converged  to  approximately  0.0. 

The  maximum  time  it  takes  to  achieve  a  good  identification  depends  upon  how  quickly  the  fault 
parameters  converge,  which  can  vary  from  almost  instantaneously  to  several  seconds  as  demonstrated 
by  the  examples.  In  general,  however,  with  the  combination  of  logic  used  to  examine  the  fault 
parameters  and  the  windowed  residual  information,  it  is  usually  possible  to  identify  a  failure  and 
estimate  its  magnitude  in  a  short  period  of  time. 

CONCLUSIONS 

A  scheme  to  detect,  isolate,  identify  and  estimate  the  type  and  magnitude  of  sensor  faults  in  a  T700 
turboshaft  engine  has  been  developed  and  demonstrated.  It  is  an  integral  part  of  a  proposed  Intelligent 
Control  System. 

The  injection  of  a  fault  caused  the  residual  to  exceed  the  threshold  value  and  trigger  the  identification 
scheme.  Once  running,  the  scheme  produced  accurate  results,  usually  in  under  a  second.  The  identified 
fault  parameters  can  be  used  in  the  state  equation  to  cancel  the  bias  or  eliminate  the  incorrect  gain, 
thereby  accommodating  the  sensor  faults  and  allowing  the  closed  loop  system  to  run  as  if  unimpaired. 
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Figure  2.  Cross  section  of  a  T700  turboshaft  engine 
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igure  3.  Estimates  corresponding  to  a  1 .8%  bias  in  the  Ng  sensor  output 
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Figure  4.  Estimates  corresponding  to  a  1 .8%  bias  in  the  Ng  sensor  output 
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Figure  5.  Hypothesis  testing  results  for  a  1 .8%  bias  in  the  Ng  sensor  gain 
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Figure  6.  Estimates  corresponding  to  a  0.1  multiplicative  gain  in  the  Ng  sensor 
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Figure  7.  Estimates  corresponding  to  a  0.1  multiplicative  gain  in  the  Ng  sensor 
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monitoring  capabilities.  The  intelligent  control  system  will  allow  for  accommodation  of  faults,  reduce  maintenance  cost, 
and  increase  system  availability.  The  scheme  compares  the  measured  outputs  of  the  engine  with  the  expected  outputs  of 
an  engine  whose  sensor  suite  is  functioning  normally.  If  the  differences  between  the  real  and  expected  outputs  exceed 
threshold  values,  a  fault  is  detected.  The  isolation  of  sensor  failures  is  accomplished  through  a  fault  parameter  isolation 
technique  where  parameters  which  model  the  faulty  process  are  calculated  on-line  with  a  real-time  multivariable  param¬ 
eter  estimation  algorithm.  The  fault  parameters  and  their  patterns  can  then  be  analyzed  for  diagnostic  and  accommodation 
purposes.  The  scheme  is  applied  to  the  detection  and  diagnosis  of  sensor  faults  of  a  T700  turboshaft  engine.  Sensor 
failures  are  induced  in  a  T700  nonlinear  performance  simulation  and  data  obtained  are  used  with  the  scheme  to  detect, 
isolate,  and  estimate  the  magnitude  of  the  faults. 
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